Flight Control Systems, Fly-by-Wire & Autopilots
From cables to computers. Learn mechanical, hydraulic and fly-by-wire flight controls, actuators (servo-hydraulic, EHA, EMA), stability augmentation (pitch and yaw dampers), control laws (normal, alternate, direct) and envelope protection, autopilot modes and loop structure (inner attitude loops, outer path loops, autothrust), redundancy and dissimilarity, and drone flight controllers — with Python simulating a pitch-rate damper.
Early aircraft connected the stick to the surfaces with cables. As aircraft grew, hydraulics boosted forces; since the Concorde and Airbus A320, fly-by-wire (FBW) sends pilot commands as electrical signals to computers, which decide how to move the surfaces.
Flight control computers make aircraft easier and safer to fly: they add damping, protect the envelope (stall, overspeed, excessive g) and allow aircraft that would be unstable without them. Autopilots automate everything from holding heading to fully automatic landing.
An analogy
Fly-by-wire is like a skilled co-pilot between you and the controls: you say 'pitch up gently' and they work out exactly how much elevator to use, while refusing to let you stall or over-stress the aircraft.
Primary and secondary controls
Primary: elevator (pitch), ailerons (roll), rudder (yaw) — and on some aircraft spoilerons, elevons (delta wings) or ruddervators (V-tails). Secondary: flaps, slats, spoilers/speedbrakes and trim. Helicopters use collective and cyclic pitch plus tail-rotor pedals.
From mechanical to fly-by-wire
Evolution of flight control:
- Reversible mechanical — pilot feels aerodynamic loads directly
- Powered (irreversible) hydraulic — artificial feel units simulate loads
- Fly-by-wire — computers command actuators; no mechanical link (or only backup)
- Power-by-wire — electro-hydrostatic (EHA) and electro-mechanical (EMA) actuators remove central hydraulics
- Fly-by-light — fibre-optic signalling for EMI immunity
Control laws and protections
Airbus normal law commands load factor (C*-like) in pitch and roll rate, with protections for angle of attack (alpha-floor), overspeed, bank and load factor; degraded laws (alternate, direct) remove protections after failures. Boeing FBW preserves conventional feel with envelope 'soft' protections. Military aircraft use full-authority control laws to fly statically unstable, highly agile designs.
Autopilots, redundancy and drones
Autopilots are cascaded loops: fast inner loops (rates, attitude) and slower outer loops (altitude, heading, speed, glide path, LNAV/VNAV from the FMS), with autothrust holding speed. Safety comes from redundancy (triplex/quadruplex computers and sensors, voting and monitoring), dissimilarity (different processors, software teams), and independent hydraulic/electrical supplies — targeting catastrophic failure < 10⁻⁹ per flight hour. Drone flight controllers (PX4, ArduPilot) run the same cascaded PID structure at 400+ Hz on MEMS sensors.
Formulas
- Short-period dynamics:
α̇ = Z_α·α + q; q̇ = M_α·α + M_q·q + M_δ·δ_e - Pitch damper:
δ_e = δ_pilot + K_q·q → M_q,eff = M_q + M_δ·K_q - Characteristic equation:
s² − (Z_α + M_q)s + (Z_α·M_q − M_α) = 0 - Autopilot cascade:
altitude → vertical speed → pitch attitude → pitch rate → elevator - Redundancy (triplex):
P(total loss) ≈ p³ (independent channels)
Worked example: Damper gain
Given: Z_α −1.2, M_α −8, M_q −0.6, M_δ −12; target ζ = 0.7
Find: K_q.
- ζ = −(Z_α + M_q')/(2ω), ω² = Z_α M_q' − M_α
- Solving numerically
Answer: K_q ≈ 0.26 (0.3 gives ζ = 0.75)
Worked example: Triplex reliability
Given: Channel failure 1e-3 per flight
Find: All three fail (independent).
- (1e-3)³
Answer: 1e-9 per flight
Worked example: Autopilot bandwidth separation
Given: Inner pitch loop bandwidth 3 rad/s
Find: Altitude loop bandwidth.
- ≈ 1/5 to 1/10 of inner loop
Answer: ≈ 0.3–0.6 rad/s
Pitch-rate damper on short-period dynamics
# Short-period pitch dynamics with and without a pitch-rate damper (Euler integration)
# alpha' = Za*alpha + q ; q' = Ma*alpha + Mq*q + Md*de
Za, Ma, Mq, Md = -1.2, -8.0, -0.6, -12.0
def run(Kq):
a, q, dt, peak_q = 0.0, 0.0, 0.001, 0.0
crossings, prev = 0, 0.0
for n in range(int(6 / dt)):
de_pilot = -0.02 if n * dt < 0.5 else 0.0 # 0.5 s elevator pulse
de = de_pilot + Kq * q # damper feeds back pitch rate
a, q = a + dt * (Za * a + q), q + dt * (Ma * a + Mq * q + Md * de)
peak_q = max(peak_q, abs(q))
if n * dt > 0.5 and prev * q < 0: crossings += 1
prev = q
return peak_q, crossings, abs(q)
import math
for Kq in (0.0, 0.3):
pk, cr, end = run(Kq)
Mq_eff = Mq + Md * Kq # damper adds pitch damping
wn = math.sqrt(Za * Mq_eff - Ma) # s^2 - (Za+Mq')s + (Za*Mq' - Ma)
zeta = -(Za + Mq_eff) / (2 * wn)
print(f"Kq={Kq}: wn={wn:.2f} rad/s, zeta={zeta:.2f}, peak pitch rate {pk:.3f} rad/s")
# Kq=0.0: wn=2.95 rad/s, zeta=0.30, peak pitch rate 0.077 rad/s
# Kq=0.3: wn=3.61 rad/s, zeta=0.75, peak pitch rate 0.039 rad/sFeeding back pitch rate adds artificial pitch damping: the short-period damping ratio rises from 0.30 (bouncy) to 0.75 (crisp), and the pitch-rate overshoot halves. Every jet airliner has yaw dampers built on the same idea for the Dutch roll mode.
Common mistakes
- Wrong: Single sensor feeding a critical control law. — Right: Redundant, cross-checked sensors (lesson of MCAS).
- Wrong: Outer loop as fast as inner loop. — Right: Separate bandwidths by 3–10×.
- Wrong: Ignoring actuator rate limits. — Right: Rate saturation causes pilot-induced oscillation.
Applications
- Airliners: Airbus/Boeing FBW with envelope protection.
- Fighters: Relaxed-stability designs flown by computers.
- Helicopters: Stability augmentation and FBW (NH90, S-92 AFCS).
- Drones & eVTOL: Multicopters are impossible to fly without flight controllers.
Key takeaways
- FBW: computers between pilot and surfaces.
- Dampers feed back rates to add damping.
- Envelope protection prevents stall and overstress.
- Redundancy + dissimilarity for 1e-9 safety.
Going further
- Nonlinear dynamic inversion: Model-based control laws for agile aircraft.
- Incremental NDI: Sensor-based robustness, used in research FBW.
- Formal verification: Model checking of control-law logic.